Detection & Case Management Lead

Program Overview

About The Role

We are seeking a highly skilled and innovative Detection and Case Management Lead to join our team in the greater DMV area, supporting the Army National Guard.

Key Responsibilities

• Define and govern detection architecture standards and lifecycle for correlation rules, signatures, behavioral analytics, and analytics pipelines aligned to MITRE ATT&CK and prioritized risks.
• Translate threat intelligence, CDAP/CHAP/vulnerability findings into prioritized, testable detection use cases and automated alerting frameworks.
• Oversee detection validation using telemetry analysis, adversary emulation, red‑team exercises, and lab testbeds; tune to reduce false positives and alert fatigue.
• Lead end‑to‑end case management design: triage, enrichment, documentation, escalation, remediation tracking, and closure processes with SLAs and audit controls.
• Establish runbooks, QA controls, and standard operating procedures for detection tuning and investigative documentation.
• Partner with data engineering to improve telemetry ingestion, normalization, enrichment, retention, and evidence integrity for investigations.
• Implement dashboards and reporting for detection efficacy, MTTD, MTTR, case quality, and executive risk metrics.
• Mentor SOC/NOSC analysts and coordinate with incident response, threat intel, vulnerability management, and service owners.
• Maintain continuous improvement process for detection coverage, playbooks, and case management maturity.

#ENOCS

Qualifications

Required Qualifications

• 5 years with BS/BA; 3 years with MS/MA; 0 years with PhD
• Clearance: TS/SCI (active)
• Education / Training / Certification: Candidate must meet ONE of the following:
  • Master’s or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, or Software Engineering; OR
  • Relevant DoD/Military training (e.g., 4C‑255N (CP)); OR
  • Relevant certifications (see list below).
• Experience: Progressive cybersecurity experience focused on detection engineering, SOC operations, or security case management in enterprise/DoD environments.
• Demonstrated expertise in SIEM rule engineering, EDR/XDR tuning, IDS/IPS signatures, cloud-native detection, OT/DCI monitoring, and MITRE ATT&CK mapping.
• Proven experience translating threat intel and vulnerability data into operational detection use cases and validated analytics.
• Strong skills in tooling (SIEM, SOAR, EDR, network telemetry), telemetry normalization, analytic validation, and creating decision‑grade dashboards and runbooks.
• Excellent written and verbal communication for briefings to technical and executive audiences.

Acceptable Certifications (one or more preferred)

• CISSP‑ISSAP, CISSP‑ISSEP, GCIA, GICSP, or equivalent advanced detection/forensics certifications

Desired / Preferred

• Prior DoD/Army/ARNG SOC or NOSC experience
• Experience with threat emulation frameworks, Purple Teaming, SOAR playbook development, cloud detection platforms, and telemetry engineering
• Familiarity with CDAP/CHAP assessment processes and compliance/audit evidence requirements

#ENOCS

SCA / Union / Intern Rate or Range

Details

Target Salary Range: $80,000 - $128,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Benefits Statement: Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at

Application Duration Statement: The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates.

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.